full-disclosure - Re: Vulnerabilities in *McAfee.com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 31 Mar 2011 18:30:19 -0400
From: Valdis.Kletnieks@...edu
To: Cal Leeming <cal@...whisper.co.uk>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerabilities in *McAfee.com

On Wed, 30 Mar 2011 20:33:56 BST, Cal Leeming said:
> Like with most laws, the key point is "intent". If your intention was
> clearly not malicious, then you are safe.

Ask Randall Schwartz how that worked out for him. "intent" doesn't
enter into it as much as a defendant may like.

http://www.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00001030----000-.html

Intent is not mentioned at all.  You exceed the authorized access, you're
guilty under 18 USC 1030.  1030 (a)(2)(C) is the really expansive one, as
"protected computer" is defined down in (e)(2)(B) to include anything used in
interstate commerce (and yes, DA's *HAVE* argued "The computer has a web
browser and thus could get to amazon.com, so it's interstate commerce time").

Doesn't matter if you were trying to save the world at the time (as Gary
McKinnon found out).

A better approach is to argue the definition of "authorized access" as it applies
to an Internet-facing server...

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/